MedusaLocker is a ransomware-as-a-service operation that emerged in September 2019 and primarily targets healthcare, education, and government organizations. The group initially relied on phishing emails with malicious attachments as the primary attack vector. However, in 2022, the group shifted strategy to exploit exposed RDP services with weak passwords, making RDP brute-force attacks the dominant initial access method. MedusaLocker encrypts files using AES-256 symmetric encryption paired with RSA-2048 public-key encryption, employs a RaaS model recruiting affiliates to conduct initial access and lateral movement, and operates double extortion by exfiltrating data before encryption.

Operational patterns suggest MedusaLocker operators are based in Eastern Europe or the CIS region. The group’s focus on English-language ransom notes and healthcare-targeting suggests possible Russian or Ukrainian origin. No definitive geolocation has been published by threat intelligence firms.

MedusaLocker attacks begin with RDP service scanning and brute-force password attacks against common usernames (administrator, guest) using weak password dictionaries. Once an RDP account is compromised, attackers connect to the network and conduct lateral movement using stolen credentials, Mimikatz for credential dumping, and tools like PsExec for command execution. Attackers identify and exfiltrate sensitive data (patient records, financial data, personal information) using tools like FileZilla or Rclone. Finally, the MedusaLocker ransomware binary is deployed across the network to encrypt all accessible files. Ransom notes (How_to_back_files.html) are dropped in user directories.

From initial RDP brute-force compromise to encryption and ransom demand, MedusaLocker attacks typically span 1–3 weeks. RDP compromise to credential dumping may take 1–5 days; lateral movement and data exfiltration occupy 5–15 days; encryption deployment occurs within final 24–48 hours.

MedusaLocker-encrypted files cannot be decrypted without the RSA-2048 private key held by operators. Older variants (v1 and early v2) have public decryptors available from Emsisoft or No More Ransom—check these websites before paying any ransom. Current variants (v3+) have no public decryptor. Deletion of the malware stops further encryption but does not recover encrypted files.

When MedusaLocker infects your network via RDP compromise, files are encrypted with various extensions (.deadfiles, .readinstructions, .lockfiles, etc.) and become inaccessible. You discover the compromise when users report inability to access files and systems become unresponsive. Ransom notes (How_to_back_files.html) appear on all infected systems, directing you to access a Tor website with a unique victim ID to negotiate. Additionally, a ransom note appears on the dark web leak site, threatening to publish exfiltrated data if you do not pay within 3–7 days.

Prevent MedusaLocker attacks by: (1) disabling or restricting RDP access from the internet—expose RDP only via VPN with MFA; (2) enforcing strong, unique passwords (minimum 16 characters) on all RDP accounts; (3) implementing multi-factor authentication on all RDP and VPN access; (4) monitoring RDP login logs for brute-force attempts and failed logins; (5) implementing network segmentation isolating critical systems from general corporate networks; (6) deploying EDR solutions with behavioral detection for credential dumping and lateral movement; (7) maintaining immutable, off-site backups; (8) disabling RDP on systems that do not require it; and (9) blocking RDP on non-standard ports if possible.

– Disable RDP access from the internet entirely; expose RDP only via VPN
– Require multi-factor authentication on all RDP and VPN endpoints
– Enforce strong, unique passwords (minimum 16 characters) on all RDP accounts
– Monitor and alert on RDP login failures (brute-force attempts) and unusual successful logins
– Implement network segmentation isolating critical systems from general corporate networks
– Deploy EDR solutions with behavioral detection for credential dumping and lateral movement activity
– Create daily incremental backups with immutable (write-once) offline storage
– Test backup restoration monthly to ensure recovery capability
– Disable RDP on systems that do not require it
– Implement firewall rules restricting RDP access by source IP if possible
– Monitor for unusual PowerShell execution (particularly vssadmin delete shadows) and alert on shadow copy deletion
– Implement local admin password management (LAPS) to randomize and secure local account passwords
– Conduct quarterly vulnerability scans of all systems for unpatched RDP vulnerabilities

MedusaLocker is one of the longest-running ransomware operations (active since 2019) and represents the traditional encryption-based RaaS model. Newer groups like Sarcoma employ “Living Off the Land Remotely” tactics using legitimate RMM tools, while Cicada3301 specifically targets virtualized infrastructure (ESXi hypervisors). MedusaLocker’s RDP-focused approach is more of an “opportunistic” targeting strategy—the group scans broadly for exposed RDP services rather than conducting targeted reconnaissance. This makes MedusaLocker both easier to defend against (disable RDP) and more likely to impact smaller organizations with exposed remote access infrastructure.

Yes, for some older variants. Emsisoft released a free decryptor for MedusaLocker v1 and v2 variants, available at the No More Ransom project (nomoreransom.org). Check the website to see if your specific variant has a public decryptor before paying any ransom. However, no public decryptors exist for current MedusaLocker v3 variants, making air-gapped backups the only reliable recovery option for recent attacks.